Skip to contentRed Hat Ansible Automation Platform vulnerabilities
- encode starlette, red hat exploit intelligence, openshift lightspeed +18 more +20 moreStarlette has missing Host header validation that poisons request.url.path, bypassing path-based security checksCVE-2026-48710In KEVPublic exploitFix availableEPSS 70.3%6.5 Medium
- js-cookie javascript cookie, js-cookie, red hat cryostat 4 on rhel 9 +24 more +26 moreJavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injectionCVE-2026-46625Fix available7.5 High
- berriai litellm, red hat exploit intelligence, ansible automation platform 2 +1 more +3 moreLiteLLM < 1.83.10 Privilege Escalation via User UpdateCVE-2026-47102Public exploitFix available8.7 High
- berriai litellm, red hat exploit intelligence, ansible automation platform 2 +1 more +3 moreLiteLLM < 1.83.14 Privilege Escalation via API Key GenerationCVE-2026-47101Public exploitFix available8.7 High
- red hat ansible automation platform 2, openstack platform 18.0, quay 3 +1 more +3 moreAPScheduler's JSONSerializer and CBORSerializer are vulnerable to Remote Code Execution (RCE) via Insecure DeserializationCVE-2026-310729.8 Critical
- jsonpickle python jsonpickle, red hat ansible automation platform 2 +1 morepython jsonpickle 2.0.0 Remote Code Execution via py/reprCVE-2021-479529.3 Critical
- io.opentelemetry opentelemetry-api, opentelemetry-extension-trace-propagators, open-telemetry opentelemetry-java +17 more +19 moreopentelemetry-java: Unbounded Memory Allocation in W3C Baggage PropagationCVE-2026-45292Fix available5.3 Medium
- postgresql, red hat ansible automation platform 2.2, enterprise linux 10 +16 more +18 morePostgreSQL server undersizes allocations, via integer wraparoundCVE-2026-6473Fix available8.8 High
- patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 morevm2: Sandbox Breakout Using Async GeneratorCVE-2026-45411Fix available9.8 Critical
- protobufjs project protobufjs, protobufjs protobuf.js, red hat openshift pipelines +20 more +22 moreprotobufjs: Code injection through bytes field defaults in generated toObject codeCVE-2026-44293Fix available7.7 High
- protobufjs project protobufjs, protobufjs protobuf.js, red hat openshift pipelines +13 more +15 moreprotobufjs: Denial of service through unbounded protobuf recursionCVE-2026-44289Fix available7.5 High
- python urllib3, red hat exploit intelligence, external secrets operator for red hat openshift +48 more +50 moreurllib3: Decompression-bomb safeguards bypassed in parts of the streaming APICVE-2026-44432Fix available8.9 High
- masci banks, red hat exploit intelligence, openshift lightspeed +1 more +3 moreBanks: Critical Remote Code Execution (RCE) via Jinja2 SSTICVE-2026-44209Fix available7.5 High
- patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 morevm2: Sandbox Breakout Through Null Proto ExceptionCVE-2026-44009Fix available9.8 Critical
- patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 morevm2 has sandbox breakout via `neutralizeArraySpeciesBatch`CVE-2026-44008Fix available9.8 Critical
- go standard library net/mail, golang go, red hat assisted installer for red hat openshift container platform 2 +108 more +110 moreQuadratic string concatenation in consumePhrase in net/mailCVE-2026-42499Fix available7.5 High
- go standard library net/mail, golang go, red hat assisted installer for red hat openshift container platform 2 +107 more +109 moreQuadratic string concatentation in consumeComment in net/mailCVE-2026-39820Fix available7.5 High
- go standard library net/http, golang go, http2 +106 more +108 moreInfinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/netCVE-2026-33814Fix available7.5 High
- go standard library net, golang go, red hat assisted installer for red hat openshift container platform 2 +145 more +147 moreCrash when handling long CNAME response in netCVE-2026-33811Fix available7.5 High
- patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 morevm2: nesting: true bypasses require: false, allowing sandbox escape to arbitrary OS command executionCVE-2026-44007Fix available9.1 Critical
- patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 morevm2: NodeVM require.root bypass via symlink traversal allows sandbox escapeCVE-2026-43998Fix available8.5 High
- patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 morevm2: Host Process OOM DoS via Buffer.alloc (Timeout Bypass)CVE-2026-44004Fix available7.5 High
- patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 morevm2: Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)CVE-2026-44001Fix available8.6 High
- patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 morevm2: NodeVM builtin allowlist bypass via `module` builtin's `Module._load` allows sandbox escapeCVE-2026-43999Fix available9.9 Critical
- patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 morevm2: Sandbox escapeCVE-2026-44005Fix available10.0 Critical
- patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 morevm2: Sandbox EscapeCVE-2026-43997Fix available10.0 Critical
- patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 morevm2: Sandbox EscapeCVE-2026-44006Fix available10.0 Critical
- kludex python-multipart, red hat exploit intelligence, openshift lightspeed +11 more +13 morePython-Multipart: Denial of Service via unbounded multipart part headersCVE-2026-42561Fix available7.5 High
- beaugunderson ip-address, red hat confidential compute attestation, cryostat 4 +38 more +40 moreip-address: XSS in Address6 HTML-emitting methodsCVE-2026-42338Fix available5.3 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofingCVE-2026-123828.2 High
- axios, red hat cryostat 4, gatekeeper 3 +45 more +47 moreAxios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijackingCVE-2026-42264Fix available7.4 High
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +1 more +3 moreAap-controller: aap-gateway: account hijacking and unauthorized access via unverified email linkingCVE-2026-62668.3 High
- websockets ws, red hat cryostat 4, cryostat 4 on rhel 9 +47 more +49 morews: Uninitialized memory disclosureCVE-2026-45736Fix available4.4 Medium
- pallets click click, red hat ansible automation platform 2, ansible automation platform 2.5 for rhel 8 +3 more +5 more[DISPUTED] Pallets Click contains a command injection via Unsanitized Filename "click.edit()"CVE-2026-7246Fix availableDisputed7.2 High
- berriai litellm, red hat exploit intelligence, ansible automation platform 2 +5 more +7 moreLiteLLM: Authenticated command execution via MCP stdio test endpointsCVE-2026-42271In KEVPublic exploitFix availableEPSS 91.4%8.7 High
- axios, red hat cryostat 4, gatekeeper 3 +61 more +63 moreAxios: unbounded recursion in toFormData causes DoS via deeply nested request dataCVE-2026-42039Fix available6.9 Medium
- axios, red hat cryostat 4, gatekeeper 3 +57 more +59 moreAxios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge StrategyCVE-2026-42041Fix available4.8 Medium
- axios, red hat cryostat 4, gatekeeper 3 +56 more +58 moreAxios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0CVE-2026-42043Fix available7.2 High
- axios, red hat cryostat 4, gatekeeper 3 +59 more +61 moreAxios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`CVE-2026-42044Fix available6.5 Medium
- axios, red hat cryostat 4, gatekeeper 3 +57 more +59 moreAxios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request HijackingCVE-2026-42033Fix available7.4 High
- berriai litellm, red hat lightspeed core, ansible automation platform 2 +1 more +3 moreLiteLLM: SQL injection in Proxy API key verificationCVE-2026-42208In KEVPublic exploitFix availableEPSS 89.4%9.3 Critical
- berriai litellm, red hat exploit intelligence, ansible automation platform 2 +1 more +3 moreLiteLLM: Server-Side Template Injection in /prompts/test endpointCVE-2026-42203Public exploitFix available8.6 High
- python-poetry poetry, red hat ansible automation platform 2, ansible automation platform 2.6 +3 more +5 morePoetry: Path traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4CVE-2026-41140Fix available0.6 Low
- red hat ansible automation platform 2Aap-mcp-server: aap mcp server: log injection allows social engineering attacks via unsanitized inputCVE-2026-64945.3 Medium
- langchain langchain-text-splitters, red hat migration toolkit for applications 8, openshift lightspeed +2 more +4 moreLangChain: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect BypassCVE-2026-41481Fix available6.5 Medium
- protobufjs project protobufjs, protobufjs protobuf.js, red hat cryostat 4 +20 more +22 moreprotobufjs has an arbitrary code execution issueCVE-2026-41242Public exploitFix available9.4 Critical
- follow-redirects, red hat cluster observability operator 1.5.0, cryostat 4 +79 more +81 morefollow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect TargetsCVE-2026-40895Fix available6.9 Medium
- jqlang jq, red hat ai inference server 3.2, ai inference server 3.3 +38 more +40 morejq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted BuffersCVE-2026-39979Fix available6.9 Medium
- python pillow, red hat lightspeed core, openshift lightspeed +27 more +29 morePillow is vulnerable to a FITS GZIP decompression bombCVE-2026-40192Fix available8.7 High
- axios, red hat cryostat 4, gatekeeper 3 +63 more +65 moreAxios has Unrestricted Cloud Metadata Exfiltration via Header Injection ChainCVE-2026-40175Public exploitFix available4.8 Medium
- Show moreLoading…